[syslog-ng] destination program is killed due to broken pipe

[midnight codder]

I realized strace is a unix command and not an option of syslog-ng. Sorry
about that.

After running syslog-ng with strace I found out, what was already known -
syslog-ng is trying to write to the destination program but getting a broken
pipe error:

This is from the output of strace:

598   write(13, "<pri=43> <date=2008-08-27T15:54:"..., 155) = -1 EPIPE
(Broken pipe)
598   --- SIGPIPE (Broken pipe) @ 0 (0) ---
598   kill(600, SIGTERM)                = 0

And this is from the catch-all destination file:
<pri=46> <date=2008-08-27T15:54:35.092-05:00> <host=oracle-test>
<msg=syslog-ng[596]: Starting destination program; cmdline='bash
/usr/local/bds/logger/syslogAdapterProgram.sh'>
<pri=45> <date=2008-08-27T15:54:35.101-05:00> <host=oracle-test>
<msg=syslog-ng[598]: syslog-ng starting up; version='2.1.11a'>
<pri=46> <date=2008-08-27T15:54:35.102-05:00> <host=oracle-test>
<msg=syslog-ng[598]: Initializing destination file writer;
template='/var/log/syslog-ng-catch-all.log',
filename='/var/log/syslog-ng-catch-all.log'>
<pri=43> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test>
<msg=syslog-ng[598]: I/O error occurred while writing; fd='11',
error='Broken pipe (32)'>
<pri=46> <date=2008-08-27T15:54:35.174-05:00> <host=oracle-test>
<msg=syslog-ng[598]: Sending child a TERM signal; child_pid='597'>

I guess my question is: are there any configuration options I was over
looking, that may resolve this? Or am I not using the Scanner the right way?
what can cause a broken IO pipe?

Thanks.

On Thu, Aug 21, 2008 at 7:25 AM, Balazs Scheidler <bazsi at balabit.hu> wrote:

> On Wed, 2008-08-20 at 09:10 -0500, midnight codder wrote:
> > Thanks for all of those alternatives.
> > Allow me to rephrase my question (any idea): Does anyone have any idea
> > as to why I am getting the broken pipe?
> > The script I am using now is for the sake of simplifying things so I
> > can pin point where troubles begin.
> > We are not going to use such a script in production.
> > The original java program that was supposed to be the destination is
> > much more complicated, although in a sense it still reads the log
> > messages off of std in, just like the script. (it is the handling of
> > the logs afterwards that is complex).
> > I shall investigate into using one of the alternatives, however - I
> > will still be happy to know what might have went wrong.
>
> >
> >         <priC> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test>
> >         <msg=syslog-ng[27971]: I/O error occurred while writing;
> >         fd='11', error='Broken pipe (32)'>
> >         <priF> <date 08-08-19T15:13:56.198-05:00> <host=oracle-test>
> >         <msg=syslog-ng[27971]: Sending child a TERM signal;
> >         child_pid='27972'>
>
> Your script terminates for some reason, it's not syslog-ng that kills
> your process, it is your script that dies.
>
> please run syslog-ng under strace -f (to follow forks) and see why your
> shell script exits.
>
> --
> Bazsi
>
>
> ______________________________________________________________________________
> Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
> Documentation:
> http://www.balabit.com/support/documentation/?product=syslog-ng
> FAQ: http://www.campin.net/syslog-ng/faq.html
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080827/302ce7db/attachment-0001.htm